cloud-penetration-testing
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
51
41%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Critical
Do not install without reviewing
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/cloud-penetration-testing/SKILL.mdQuality
Discovery
32%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
The description identifies a clear domain (cloud security across Azure, AWS, GCP) but remains too high-level in describing specific capabilities and completely lacks trigger guidance ('Use when...'). It would benefit from listing concrete assessment actions and explicit conditions under which Claude should select this skill.
Suggestions
Add a 'Use when...' clause with trigger terms like 'cloud security audit', 'AWS security review', 'Azure compliance check', 'GCP misconfiguration', 'IAM policy review'.
Replace 'comprehensive security assessments' with specific concrete actions such as 'audit IAM policies, review network security groups, check encryption configurations, assess compliance posture, identify misconfigurations'.
Include common user-facing terms and variations like 'cloud audit', 'security scan', 'vulnerability assessment', 'CIS benchmarks', 'cloud posture' to improve trigger term coverage.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (cloud infrastructure security) and the three major cloud providers, but 'comprehensive security assessments' is a broad action rather than listing specific concrete actions like 'review IAM policies, audit network configurations, check encryption settings'. | 2 / 3 |
Completeness | Describes what it does (security assessments of cloud infrastructure) but completely lacks a 'Use when...' clause or any explicit trigger guidance for when Claude should select this skill. Per rubric guidelines, a missing 'Use when...' clause caps completeness at 2, and the 'what' is also somewhat vague, warranting a score of 1. | 1 / 3 |
Trigger Term Quality | Includes good cloud provider keywords (Azure, AWS, GCP) and 'security assessments' and 'cloud infrastructure', but misses common user variations like 'cloud security audit', 'vulnerability scan', 'compliance check', 'misconfiguration', 'IAM review', or abbreviations users might naturally use. | 2 / 3 |
Distinctiveness Conflict Risk | The focus on cloud infrastructure security across three specific providers gives it some distinctiveness, but 'comprehensive security assessments' is broad enough to potentially overlap with general security review skills, compliance skills, or cloud management skills. | 2 / 3 |
Total | 7 / 12 Passed |
Implementation
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill provides highly actionable, executable commands across Azure, AWS, and GCP for cloud penetration testing, which is its primary strength. However, it is excessively verbose with significant redundancy between workflow phases and quick reference tables, and it lacks validation checkpoints between phases despite covering risky operations like persistence and exploitation. The content would benefit greatly from splitting platform-specific details into separate reference files and adding explicit verification steps.
Suggestions
Split platform-specific commands (Azure, AWS, GCP) into separate reference files and keep SKILL.md as a concise overview with the workflow structure and cross-platform concepts only.
Remove the Quick Reference tables or remove the detailed inline commands—having both is redundant and doubles the token cost.
Add explicit validation checkpoints between phases, especially before exploitation and persistence phases (e.g., 'Verify current permissions before proceeding', 'Confirm scope authorization for this resource').
Remove the 'Required Knowledge' section entirely—Claude already knows cloud architecture fundamentals and IAM concepts.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose at ~400+ lines, with significant redundancy between the main workflow sections and the Quick Reference tables that repeat the same commands. The 'Required Knowledge' section lists things Claude already knows, and the 11-phase workflow could be dramatically condensed. Many commands are basic CLI usage that doesn't need this level of detail. | 1 / 3 |
Actionability | The skill provides fully executable, copy-paste ready commands across all three cloud platforms. Every phase includes concrete bash/PowerShell commands with specific flags, endpoints, and expected outputs. The examples section provides realistic scenarios with complete command sequences. | 3 / 3 |
Workflow Clarity | The 11 phases provide a clear sequence, but there are no validation checkpoints between phases, no feedback loops for error recovery, and no explicit criteria for when to proceed from one phase to the next. For operations involving persistence and exploitation (destructive/risky operations), the absence of verification steps is a significant gap. | 2 / 3 |
Progressive Disclosure | There is one reference to an advanced scripts file, but the main document is monolithic with hundreds of lines of inline commands that could be split into per-platform reference files. The Quick Reference tables at the end duplicate content from the workflow sections rather than serving as a concise overview pointing to detailed materials. | 2 / 3 |
Total | 8 / 12 Passed |
Validation
81%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 9 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
skill_md_line_count | SKILL.md is long (510 lines); consider splitting into references/ and linking | Warning |
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 9 / 11 Passed | |
- Repository
- sickn33/antigravity-awesome-skills
- Commit
6a07b83
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.